A detailed analysis shows the July mass crossing into Ceuta was planned and coordinated. Organizers used social media to recruit and conceal their identities. Economic motives and new tactics complicate detection.
The mass entry of 72,000 people from Morocco into Ceuta on July 30 and 31 was not a spontaneous movement but a deliberately organized operation, according to a new investigation by Golden Owl, a startup linked to the University of Alicante. The study, based on extensive monitoring of Moroccan social media activity, found that the event was orchestrated through a network of recruiters, coded language, and strict security measures to hide the identities of those involved.
Researchers identified a three-layer structure behind the operation. At its core was a closed coordination group using private messaging to set meeting points, times, and tactics for crossing the border. Surrounding this was a public layer on Facebook, where large groups and pages—some with over a million declared members—spread information and motivated candidates. The third layer consisted of micro-recruiters, each assembling their own cells and communicating through private channels. Organizers frequently changed keywords, fragmented messages with punctuation, and avoided posting direct links in main posts to evade detection.
The investigation highlighted that recruitment was selective, with quotas for each cell, and not simply a mass call to action. Organizers took steps such as using one-time accounts and cross-border phone lines to further obscure their tracks. The absence of a single leader was notable; instead, the campaign operated horizontally, with a shared brand, rotating coded vocabulary, and common slogans, making it resilient to police action and content removal.
Economic incentives were central to the operation. While the public-facing groups functioned professionally and attracted advertising revenue, a paid layer operated as a genuine smuggling market. The same groups that recruited migrants also advertised commercial sex, missing persons, and offered paid services to transport young people from cities like Casablanca or Fez to Ceuta. The core group included a small set of administrators and recruiters, such as a man from Casablanca living in Istanbul, who provided a Turkish WhatsApp contact, and another based in Rome managing the largest network node.
Investigators also noted the use of Algerian-origin assets within the network, suggesting that while the operation was Moroccan-led, it relied on recycled or acquired Algerian resources. After the July surge, police pressure led to the closure of five of the most active recruitment groups, which together had over 200,000 members. However, the network quickly shifted to general-interest groups, such as a Tangier job board and groups offering European work contracts, making detection more difficult as these do not use migration-specific keywords and attract the target demographic of unemployed youth aged 18 to 25.
Recent monitoring shows that while the recruitment network has become less visible, it remains active. The migration effort has also shifted focus, with some groups now directing candidates toward Melilla, considered less guarded, and instructing arrivals in Nador to ignore security forces. This marks a significant change in tactics, with a new emphasis on evasion rather than confrontation. The study recommends expanding monitoring to Melilla and Algerian departure ports, as the organizational layer of the network was never fully reliant on Facebook and continues to adapt.
For context, the ongoing tension at the Ceuta border and the challenges of managing mass crossings have been a point of concern for both local and European authorities. As previously reported, the city's security and its relationship with Morocco remain under scrutiny, with broader implications for Spain's border policy and EU cooperation. For more on the political and security context, see this analysis of Ceuta's situation and EU debates: how Ceuta's security challenges have shaped European discussions.
Ceuta and Melilla, Spain's two North African enclaves, have long been focal points for migration from Morocco and sub-Saharan Africa. The Spanish government has responded to previous mass entries with increased border security and diplomatic efforts with Morocco. However, the adaptability of recruitment networks and their use of legitimate social media groups complicate enforcement. The findings from the Golden Owl study underscore the evolving nature of migration tactics and the need for authorities to shift from group-based monitoring to language and behavioral analysis to detect future operations.
